Splunk Search

Extract an value from logged sentence

j3r0n
Explorer

Hi,
I'm trying to make a Splunk panel display a value from a log that gets added to every 4 minutes.
I need to be able to see on the dashboard if the value suddenly drops.
I've tried extracting the value, but it keeps messing up.
Should I use regex, or do I need to extract it in a different way?
My goal is to only get the value after "value= " to return.

This is how the data looks when it's imported into Splunk, each new line is a single event:

2020-05-14T13:39:28.423Z, machine= wefqwr2312, value= 14
2020-05-14T13:40:29.003Z, machine= wefqwr2312, value= 14
2020-05-14T13:40:29.118Z, machine= wefqwr2312, value= 14
2020-05-14T13:41:28.316Z, machine= wefqwr2312, value= 14
2020-05-14T13:41:28.323Z, machine= wefqwr2312, value= 14
2020-05-14T13:45:48.032Z, machine= wefqwr2312, value= 14
2020-05-14T13:45:48.041Z, machine= wefqwr2312, value= 14

Thanks!

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Add this to your SPL and replace FIELD_NAME with your actual field name. I'd recommend fixing the logging to remove that space after value so Splunk can create the key value pair automatically without manually extracting

| rex value\=\s(?<FIELD_NAME>/d+)

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Add this to your SPL and replace FIELD_NAME with your actual field name. I'd recommend fixing the logging to remove that space after value so Splunk can create the key value pair automatically without manually extracting

| rex value\=\s(?<FIELD_NAME>/d+)

j3r0n
Explorer

Thanks alot for your reply!
I've edited the logging now, without the space after value.
Do I need a different rex now? And the extracted field of which I put the name in the regex, only has to be the "16" instead of "value=16" right?

skoelpin
SplunkTrust
SplunkTrust

Nothing further needed! Splunk will identify key value pairs automatically and extract them out for you. Splunk looks for common delimiters such as the : or = and identifies everything on the left side as the field and everything on the right side as the value. Keep it in the format of value=14

Once it has a little run time, go look at your fields on the left and find the field value to verify it extracts properly

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...